Help with blocking rules using NAT

[pilotboy72]

Hello,

I'm trying to set up a server and use NAT to access it but also to block access from certain subnets via firewall rules.

Here's what I have so far:
* (works as intended) NAT rules for three ports with associated firewall rules allowing access on my WAN interface
* (not working) Firewall rules on the WAN interface to block access from designated subnets; these firewall rules are higher on the priority list than the NAT allow rules

The designated subnets are defined as an alias and are attached to the WAN rule as a block from BLOCKED_SUBNETS to ANY on ANY TCP/UDP.

Looking at the rules in INSPECT mode, it appears that the rules are never getting evaluated as the Evaluations column shows N/A but the rules below it show thousands of evaluations.  The rules are enabled.

Any ideas on why the rules aren't getting evaluated any why traffic from the restricted subnets is getting through?

Brian